hashicorp / hashicorp/packer-plugin-azure

Support for OIDC Refresh Tokens in Azure DevOps Pipelines

Open
#507 1 comment 9 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
63
Forks
103
PR merge metrics
No merged PRs in 30d

Description

#### Community Note

Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request.
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request.
If you are interested in working on this issue or have submitted a pull request, please leave a comment.

#### Description

When using client_jwt authentication in Azure DevOps, Packer builds start but when runs take longer than one hour fail with the following error in the pipeline logs:

```authorizing request: clientCredentialsToken: received HTTP status 401 with response: {"error":"invalid_client","error_description":"AADSTS700024: Client assertion is not within its valid time range."}```

Attempting to use OIDC-based authentication with oidc_request_url and oidc_request_token results in the following error immediately on execution of the packer command.

```Build 'azure-arm.autogenerated_1' errored after 96 milliseconds 404 microseconds: githubAssertion: received HTTP status 405 with response: {"count":1,"value":{"Message":"The requested resource does not support http method 'GET'."}}```

The following example demonstrates how the environment was configured in to generate these logs in Azure DevOps pipelines:

client_jwt example:
```
- task: AzureCLI@2
inputs:
addSpnToEnvironment: true
azureSubscription: azserviceconnection
scriptType: 'bash'
scriptLocation: 'inlineScript'
inlineScript: |
export ARM_CLIENT_ID=$servicePrincipalId
export ARM_OIDC_TOKEN=$idToken
export ARM_SUBSCRIPTION_ID=$(az account show --query id -o tsv)
export ARM_USE_OIDC=true
packer init template.pkr.hcl
packer build template.pkr.hcl
```

oidc_request_url and oidc_request_token example:

```
- task: AzureCLI@2
inputs:
addSpnToEnvironment: true
azureSubscription: azserviceconnection
scriptType: bash
scriptLocation: inlineScript
inlineScript: |
export ARM_CLIENT_ID=$servicePrincipalId
export ARM_SUBSCRIPTION_ID=$(az account show --query id -o tsv)
export ARM_OIDC_REQUEST_URL=$(System.OidcRequestUri)
export ARM_OIDC_REQUEST_TOKEN=$(System.AccessToken)
export ARM_USE_OIDC=true
packer init template.pkr.hcl
packer build template.pkr.hcl
```
#### Use Case

Enable support for long-running Packer builds in Azure DevOps without needing to rely on short-lived client assertions or manually refreshing credentials.

This is especially critical for image build processes that take more than one hour, which currently fail due to token expiration issues.

#### Potential configuration

Extend the plugin’s support for OIDC by:

Enabling compatibility with Azure DevOps–issued oidc_request_url and oidc_request_token values (similar to the existing GitHub Actions support).

Supporting automatic token refresh or seamless re-authentication during long-running builds.

#### Potential References

https://github.com/hashicorp/packer-plugin-azure/tree/main/.web-docs/components/builder/arm
https://learn.microsoft.com/en-us/rest/api/azure/devops/distributedtask/oidctoken/create?view=azure-devops-rest-7.1
https://www.hashicorp.com/en/blog/version-2-packer-azure-plugin-now-available

Contributor guide

Open the contributing guide

Research direction

Start with the builder documentation in .web-docs/components/builder/arm and compare the existing GitHub Actions OIDC support with Azure DevOps’s OIDC token API. Define how oidc_request_url and oidc_request_token should be used and refreshed during long-running builds; done means Azure DevOps builds can run beyond one hour without authentication failure.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, go
Domain
authentication, cloud, devops
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.